registry / devplatform-spa-plugin-analytics / 35.5.7

devplatform-spa-plugin-analytics@35.5.7

Cross-service devplatform spa plugin analytics adapter

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package triggers an obscured remote binary downloader. It persists a short-lived stamp, drops the payload in a temp directory, and executes it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any require/import of index.js

Impact

Arbitrary code execution as the importing process user.

Mechanism

remote payload download, temp-file drop, and detached execution

Attack narrative

On import, index.js silently loads _adapter.js. Unless telemetry opt-out variables are set or a recent temp stamp exists, it retrieves a platform-specific payload from rotating worker hosts, with DNS TXT reconstruction as fallback. It writes the bytes to a temporary executable path, marks it executable on Unix, and starts it detached through /bin/sh or cmd.exe. This is an unconsented remote code-execution chain unrelated to the advertised minimal analytics API.

Rationale

Direct source inspection confirms an import-time staged-payload downloader and detached executor, not merely telemetry transport. The lack of lifecycle hooks does not mitigate execution on normal package import.

Evidence

package.jsonindex.js_adapter.jslib/telemetry.js/tmp/.analytics_state/var/tmp/.cache_<random>

Network endpoints4

oob-worker.cf101-adf.workers.dev/pkg/package

devplatform-spa-plugin-analytics@35.5.7 advertises itself as an analytics library, but on require() its main entry loads _adapter.js which downloads a platform-specific executable from obfuscated Cloudflare Workers origins (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), writes it to /tmp or %TEMP% under a hidden name (e.g..cache_<hex>, dotnet_diag_<hex>.exe), chmods it 0o755, and spawns it detached via spawn('/bin/sh', ['-c', fp+' &'], {detached:true}) or spawn('cmd',...). Destination hostnames and the DNS fallback domain are assembled at runtime by array.join to evade static extraction (e.g. ['oob-w','orker','.cf101-adf.worker','s.dev'].join('')). A DNS-TXT covert channel provides fallback delivery: the loader resolves TXT records under c.<domain> and <i>.<domain> at *.dl.wel1.ru, concatenates base64 chunks, and writes and executes the reassembled binary. No native source ships in the package, no build step exists, and the fetched bytes are opaque and unrelated to any publisher endpoint. The behavior fires automatically on require() of the package, producing full-host code execution on the installer under an attacker-controlled binary.

devplatform-spa-plugin-analytics@35.5.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code